Take the 2-minute tour ×
Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. It's 100% free, no registration required.

My team is testing some products where we have forgone SQL as the back-end. This means that we have stopped executing any security tests around SQL injection. I have this nagging suspicion that while SQL injection is not possible, that other similar injection attacks specific to these other technologies could be possible, but I have not had much time myself to put into researching those. The two non SQL solutions that we are using specifically are HBase(on top of Hadoop) and Cassandra.

Does anyone have any good ideas around how to test this or has anyone found any good reading, examples or approaches to discovering and testing these potential attacks? Alternatively any reading or explanation that could put my mind at ease and convince me these attacks aren't possible? I have searched a bit and had no luck finding any useful information on the subject.

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

Injection Attacks can be thought of as a generalized version of SQL Injection Attacks.

Any attack which uses techniques similar to SQL injection to insert characters in the front end to invoke unexpected actions on the back end can be thought of as an Injection Attack.

Consider what kinds of escape characters, improper type handling, etc could make their way to your back end if not properly filtered. Once the back end parses the query, bad thinks could happen.

This might help: http://comments.gmane.org/gmane.comp.db.cassandra.user/17844

share|improve this answer
    
Thanks, we're still following practices to escape characters, etc. My real concerns are that there is a lot of knowledge and specific tools and examples around SQL injection and much less info for injection against other nosql solutions. –  Sam Woods Dec 14 '12 at 20:19
    
I'm accepting this answer as it answers the question around CQL attacks. I still would like to see some tools/canned attacks, and would like to find some info specific to hbase injection attacks. –  Sam Woods Dec 18 '12 at 19:50
add comment

this link will not put your mind at ease but might be a starting off point for you

( google Cassandra security for more ideas )

share|improve this answer
    
Thanks Phil, I have seen some of this information, I guess my real problem is that I feel like there are too many unknowns for me. I can find a thousand sql injection attacks with a quick search, but would have to create my own list of potential CQL injection attacks to add to my testing/automation. –  Sam Woods Dec 14 '12 at 20:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.